Query to display the results contains speicifed string

(Nagesh) #1


Application name is property in the fields list of Kibana dashboard viewlet. Suppose if I need to display logs which contains application name in the log message then what query I need to use in dashboard.


(Shaunak Kashyap) #2

Hi Nagesh, I'm not sure I understood your question correctly. Are you trying to display logs that contain a specific application name in the log message?

(Nagesh) #3

Yes , you are correct.

(Shaunak Kashyap) #4

At the top of the Dashboard page there is a search bar. Initially it will contain the value * in it. You can change this to <your application field name>: "<the application name you want to search for>" and hit enter. That should narrow down the results on your dashboard to just that application.

(Lee Drengenberg) #5

Hi Nagesh,

If your field name, for example, is _type and a value in that field is apache you can put this in the discover search bar _type:apache.

If you need to search for a documents that contain a substring in a field you can use something like this links:*twitter* so that it finds things like www.twitter.com.

P.S. Nevermind, I see you're asking about Dashboard, not Discover.

(Nagesh) #6

Thank you very much Lee.

(Nagesh) #7

Hi Lee,

I have filed application in my dashboard viewlet, so I have defined query application : testApp to view the logs. It is not displaying logs related to testApp. Can you tell me what is wrong ?

(Lee Drengenberg) #8

Hi nagesh,
I just found out that I wasn't getting email notifications on these discuss topics. Did you resolve your issue?
If not, is application your field name which has values of testApp?


(system) #9